FO
Product
FortiWeb
On CISA KEVExploited in the wild
126
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 16High 49Medium 51Low 2
Watch
Add FortiWeb to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-7736 | 5.4 | Nov 22 | A stored Cross-site Scripting (XSS) vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or… Affected: through 5.7.1; 5.8.0 |
| CVE-2026-70466 | 5.3 | Aug 12 | A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions,… Affected: 8.0.0 through 8.0.2; 7.6.0 through 7.6.5; 7.4.0 through 7.4.13; 7.2.0 through 7.2.13; 7.0.0 through 7.0.12 |
| CVE-2025-48840 | 5.3 | Mar 10 | An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may… Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.8; 7.2.0 through 7.2.12; 7.0.0 through 7.0.12 |
| CVE-2023-46713 | 5.3 | Dec 13 | An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs… Affected: 6.2.0 through 6.2.8; 6.3.0 through 6.3.23; 7.0.0 through 7.0.9; 7.2.0 through 7.2.5; 7.4.0 |
| CVE-2021-41013 | 5.3 | Dec 8 | An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may allow an unauthorized… Affected: 6.3.0 through 6.3.15; 6.4.0; 6.4.1 |
| CVE-2021-32591 | 5.3 | Dec 8 | A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before… Affected: 5.7.0 through 5.7.3; 5.8.0 through 5.8.7; 6.0.0 through 6.0.7; 6.1.0 through 6.1.2; 6.2.0 through 6.2.4; 6.3.0 through 6.3.11; +2 more |
| CVE-2020-29019 | 5.3 | Jan 14 | A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated attacker to crash the httpd daemon thread… Affected: before 6.2.4; 6.3.0 through 6.3.7 |
| CVE-2026-39811 | 4.9 | Apr 14 | A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions,… Affected: 8.0.0 through 8.0.3; 7.6.0 through 7.6.6; 7.4.0 through 7.4.12; 7.2.0 through 7.2.12; 7.0.0 through 7.0.12 |
| CVE-2025-53609 | 4.9 | Sep 9 | A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated… Affected: 7.0.2 before 7.2.12; 7.4.0 before 7.4.9; 7.6.0 before 7.6.5 |
| CVE-2017-7737 | 4.9 | Aug 10 | An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in webui via the HTML… Affected: through 5.8.2 |
| CVE-2016-5092 | 4.9 | Jul 13 | Directory traversal vulnerability in Fortinet FortiWeb before 5.5.3 allows remote authenticated administrators with read and write privileges to read arbitrary files by leveraging… Affected: through 5.5.2 |
| CVE-2024-33509 | 4.8 | Jul 9 | An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and… Affected: 6.3.0 before 7.2.2 |
| CVE-2024-36509 | 4.4 | Nov 12 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiWeb version 7.6.0, version 7.4.3 and below, version 7.2.10 and below,… Affected: 6.3.0 before 7.4.4; 7.6.0 |
| CVE-2024-47569 | 4.3 | Oct 14 | A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions,… Affected: 7.6.0; 7.4.0 through 7.4.4; 7.2.0 through 7.2.13; 7.0.0 through 7.0.12; 6.4.0 through 6.4.3 |
| CVE-2022-30299 | 4.3 | Feb 16 | A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions… Affected: 6.0.0 through 6.0.8; 6.1.0 through 6.1.3; 6.2.0 through 6.2.7; 6.3.0 before 6.3.20; 6.4.0; 6.4.1; +3 more |
| CVE-2021-43074 | 4.3 | Feb 16 | An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions;… Affected: 6.0.0 before 6.3.17; 6.4.0 before 7.0.0 |
| CVE-2023-22636 | 3.3 | Feb 27 | An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker to access… Affected: 6.3.6 through 6.3.21; 6.4.0 through 6.4.2; 7.0.0 through 7.0.4 |
| CVE-2024-55593 | 2.7 | Jan 14 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWeb versions 6.3.17 through 7.6.1 allows attacker to gain information… Affected: 6.3.6 before 7.6.2 |
| CVE-2014-8619 | – | May 12 | Cross-site scripting (XSS) vulnerability in the autolearn configuration page in Fortinet FortiWeb 5.1.2 through 5.3.4 allows remote attackers to inject arbitrary web script or… Affected: 5.1.2; 5.1.3; 5.1.4; 5.2.0; 5.2.1; 5.2.2; +7 more |
| CVE-2014-4738 | – | Jul 11 | Multiple cross-site scripting (XSS) vulnerabilities in FortiGuard FortiWeb 5.0.x, 5.1.x, and 5.2.x before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via… Affected: 5.0.0; 5.0.2; 5.0.3; 5.0.4; 5.1.0; 5.1.1; +4 more |
| CVE-2014-3115 | – | May 8 | Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication… Affected: through 5.1.4; 5.1.0; 5.1.1; 5.1.2; 5.1.3 |
| CVE-2014-1957 | – | Apr 30 | FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors Affected: through 5.0.2 |
| CVE-2014-1956 | – | Apr 30 | CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via… Affected: through 5.0.2 |
| CVE-2014-1955 | – | Apr 30 | Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 5.0.2 |
| CVE-2014-1458 | – | Feb 4 | Cross-site scripting (XSS) vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject… Affected: through 5.0.3 |
| CVE-2013-7181 | – | Feb 4 | Cross-site scripting (XSS) vulnerability in user/ldap_user/add in Fortinet FortiOS 5.0.3 allows remote attackers to inject arbitrary web script or HTML via the filter parameter Affected: 5.0.3 |